swallowkit 1.0.0-beta.45 → 1.0.0-beta.47

package/src/__tests__/auth.test.ts

@@ -13,6 +13,17 @@ import {
   generateLoginPage,
   generateAuthContext,
   generateBFFCallFunctionWithAuth,
+  generateBFFCallFunctionWithSwaAuth,
+  generateSwaAuthHelperTS,
+  generateSwaAuthHelperCSharp,
+  generateSwaAuthHelperPython,
+  generateExternalTokenAdapter,
+  generateAuthenticatedFetch,
+  generateExternalTokenAuthContext,
+  generateExternalTokenVerifierTS,
+  generateExternalTokenHelperTS,
+  generateExternalTokenVerifierCSharp,
+  generateExternalTokenVerifierPython,
   generateAuthImportTS,
   generateAuthGuardTS,
   generateAuthGuardCSharp,
@@ -22,6 +33,7 @@ import { generateCompactAzureFunctionsCRUD } from "../core/scaffold/functions-ge
 import { parseAuthPolicy } from "../core/scaffold/model-parser";
 import { createBasicModelInfo } from "./fixtures";
 import { ModelAuthPolicy, CustomJwtConfig } from "../types";
+import { addAuthProviderToRootLayout, generateSwaAuthContext } from "../cli/commands/add-auth";
 
 const defaultJwtConfig: CustomJwtConfig = {
   userConnector: "mysql",
@@ -325,6 +337,97 @@ describe("generateBFFCallFunctionWithAuth", () => {
     const code = generateBFFCallFunctionWithAuth();
     expect(code).toContain("catch");
   });
+
+  it("also attaches the Functions host key", () => {
+    const code = generateBFFCallFunctionWithAuth();
+    expect(code).toContain("BACKEND_FUNCTIONS_KEY");
+    expect(code).toContain("'x-functions-key'");
+  });
+});
+
+describe("SWA built-in auth generators", () => {
+  it("wraps the root layout with AuthProvider exactly once", () => {
+    const layout = `import './globals.css';\nexport default function RootLayout({ children }: { children: React.ReactNode }) {\n  return <html><body>{children}</body></html>;\n}\n`;
+    const once = addAuthProviderToRootLayout(layout);
+    const twice = addAuthProviderToRootLayout(once);
+
+    expect(twice).toBe(once);
+    expect(once.match(/import \{ AuthProvider \}/g)).toHaveLength(1);
+    expect(once.match(/<AuthProvider>/g)).toHaveLength(1);
+    expect(once).toContain("<AuthProvider>{children}</AuthProvider>");
+  });
+
+  it("preserves a React directive before the generated import", () => {
+    const layout = `'use client';\nimport { useAuth } from '@/lib/auth/auth-context';\nexport default function RootLayout({ children }: { children: React.ReactNode }) { return <body>{children}</body>; }`;
+    const updated = addAuthProviderToRootLayout(layout);
+
+    expect(updated).toMatch(/^'use client';\nimport \{ AuthProvider \}/);
+    expect(updated.match(/AuthProvider \} from/g)).toHaveLength(1);
+  });
+
+  it("treats unavailable or invalid /.auth/me responses as anonymous", () => {
+    const code = generateSwaAuthContext();
+    expect(code).toContain("if (!response.ok)");
+    expect(code).toContain("typeof body !== 'object'");
+    expect(code).toContain(".catch(() => setUser(null))");
+    expect(code).toContain(".finally(() => setLoading(false))");
+  });
+
+  it("normalizes a valid SWA principal and its string roles", () => {
+    const code = generateSwaAuthContext();
+    expect(code).toContain("typeof value.userId !== 'string'");
+    expect(code).toContain("value.userRoles.filter");
+    expect(code).toContain("satisfies AuthUser");
+  });
+
+  it("forwards a normalized platform principal with /.auth/me fallback", () => {
+    const code = generateBFFCallFunctionWithSwaAuth();
+    expect(code).toContain("x-ms-client-principal");
+    expect(code).toContain("/.auth/me");
+    expect(code).toContain("BACKEND_FUNCTIONS_KEY");
+    expect(code).not.toContain("fetchHeaders['Authorization']");
+  });
+
+  it.each([
+    ["typescript", generateSwaAuthHelperTS()],
+    ["csharp", generateSwaAuthHelperCSharp()],
+    ["python", generateSwaAuthHelperPython()],
+  ])("generates %s principal validation and role checks", (_language, code) => {
+    expect(code).toContain("x-ms-client-principal");
+    expect(code).toContain("authenticated");
+    expect(code.toLowerCase()).toContain("role");
+    expect(code).not.toContain("JWT_SECRET");
+  });
+});
+
+describe("external token auth generators", () => {
+  it("generates a fail-closed frontend adapter and authenticated fetch", () => {
+    expect(generateExternalTokenAdapter()).toContain("return null");
+    const fetchCode = generateAuthenticatedFetch();
+    expect(fetchCode).toContain("Authorization");
+    expect(fetchCode).toContain("Bearer");
+    expect(fetchCode).toContain("status: 401");
+  });
+
+  it("handles non-JSON auth/me responses without parsing them", () => {
+    const code = generateExternalTokenAuthContext();
+    expect(code).toContain("content-type");
+    expect(code).toContain(".catch(() => setUser(null))");
+  });
+
+  it.each([
+    ["typescript", generateExternalTokenVerifierTS()],
+    ["csharp", generateExternalTokenVerifierCSharp()],
+    ["python", generateExternalTokenVerifierPython()],
+  ])("generates a fail-closed %s verifier", (_language, code) => {
+    expect(code).toContain("External token verifier is not configured");
+    expect(code).not.toContain("JWT_SECRET");
+  });
+
+  it("awaits external token verification in TypeScript guards", () => {
+    expect(generateAuthGuardTS({}, "read", "external-token")).toContain("await requireAuth(request)");
+    expect(generateExternalTokenHelperTS()).toContain("await verifyExternalToken");
+  });
 });
 
 // ============================================================

package/src/__tests__/dev.test.ts

@@ -6,6 +6,7 @@ import {
   buildFunctionsStartArgs,
   buildFunctionsCoreToolsCommand,
   buildNextDevArgs,
+  buildSwaStartArgs,
   buildDevCommand,
   buildPythonFunctionsEnv,
   compareVersionNumbers,
@@ -13,6 +14,7 @@ import {
   getFunctionsReadinessTimeoutMs,
   getCSharpFunctionsBuildArtifactPaths,
   getPythonVirtualEnvPaths,
+  getSwaCliInstallCommand,
   parseCoreToolsVersion,
   waitForHttpServerReady,
 } from "../cli/commands/dev";
@@ -70,6 +72,23 @@ describe("dev command helpers", () => {
     expect(buildFunctionsBaseUrl("127.0.0.1", "7072")).toBe("http://127.0.0.1:7072");
   });
 
+  it("builds SWA CLI arguments without bypassing the Next.js BFF", () => {
+    expect(buildSwaStartArgs(undefined, "3000", "4280")).toEqual([
+      "start",
+      "http://localhost:3000",
+      "--swa-config-location",
+      ".",
+      "--port",
+      "4280",
+    ]);
+    expect(buildSwaStartArgs(undefined, "3000", "4280")).not.toContain("--api-devserver-url");
+  });
+
+  it("provides a project-local SWA CLI install command", () => {
+    expect(getSwaCliInstallCommand("pnpm")).toBe("pnpm add -Dw @azure/static-web-apps-cli");
+    expect(getSwaCliInstallCommand("npm")).toBe("npm install -D @azure/static-web-apps-cli");
+  });
+
   it("gives C# more startup time before reporting readiness timeout", () => {
     expect(getFunctionsReadinessTimeoutMs("csharp")).toBeGreaterThan(getFunctionsReadinessTimeoutMs("typescript"));
     expect(getFunctionsReadinessTimeoutMs("csharp")).toBeGreaterThan(getFunctionsReadinessTimeoutMs("python"));
@@ -197,6 +216,8 @@ describe("dev CLI parser", () => {
       noFunctions: true,
       seedEnv: "local",
       mockConnectors: true,
+      swaPort: "4290",
+      noSwa: true,
     };
 
     const optionsAfterCommand = await parseDevOptions([
@@ -215,6 +236,9 @@ describe("dev CLI parser", () => {
       "--seed-env",
       "local",
       "--mock-connectors",
+      "--swa-port",
+      "4290",
+      "--no-swa",
     ]);
 
     const optionsBeforeCommand = await parseDevOptions([
@@ -226,6 +250,9 @@ describe("dev CLI parser", () => {
       "--seed-env",
       "local",
       "--mock-connectors",
+      "--swa-port",
+      "4290",
+      "--no-swa",
       "--no-functions",
       "--port",
       "3001",

package/src/__tests__/init.test.ts

@@ -17,6 +17,8 @@ import {
   injectSwallowKitNextConfig,
   parseIgnoredBuilds,
   buildCosmosDbFreeTierBicepSource,
+  buildFunctionsHostKeyBicepExpression,
+  buildStaticWebAppConfigBicepSource,
   withNpmLockfileSafeManifests,
 } from "../cli/commands/init";
 
@@ -100,6 +102,7 @@ module.exports = nextConfig;
     expect(dependencies).toEqual({
       "@azure/cosmos": "^4.0.0",
       applicationinsights: "^3.3.0",
+      zod: "^4.0.0",
       "@sample-app/shared": "workspace:*",
     });
     expect(dependencies).not.toHaveProperty("swallowkit");
@@ -141,6 +144,10 @@ module.exports = nextConfig;
     const projectDir = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-lockfile-"));
     fs.mkdirSync(path.join(projectDir, "shared"));
     fs.mkdirSync(path.join(projectDir, "functions"));
+    fs.mkdirSync(path.join(projectDir, "node_modules"));
+    fs.mkdirSync(path.join(projectDir, "shared", "node_modules"));
+    fs.writeFileSync(path.join(projectDir, "node_modules", ".pnpm-marker"), "root");
+    fs.writeFileSync(path.join(projectDir, "shared", "node_modules", ".pnpm-marker"), "shared");
 
     const rootPackageJson = {
       name: "sample-app",
@@ -168,10 +175,14 @@ module.exports = nextConfig;
 
       expect(normalizedRoot.dependencies["@sample-app/shared"]).toBe("file:shared");
       expect(normalizedFunctions.dependencies["@sample-app/shared"]).toBe("file:../shared");
+      expect(fs.existsSync(path.join(projectDir, "node_modules"))).toBe(false);
+      expect(fs.existsSync(path.join(projectDir, "shared", "node_modules"))).toBe(false);
     });
 
     expect(JSON.parse(fs.readFileSync(path.join(projectDir, "package.json"), "utf-8"))).toEqual(rootPackageJson);
     expect(JSON.parse(fs.readFileSync(path.join(projectDir, "functions", "package.json"), "utf-8"))).toEqual(functionsPackageJson);
+    expect(fs.readFileSync(path.join(projectDir, "node_modules", ".pnpm-marker"), "utf-8")).toBe("root");
+    expect(fs.readFileSync(path.join(projectDir, "shared", "node_modules", ".pnpm-marker"), "utf-8")).toBe("shared");
   });
 });
 
@@ -204,6 +215,22 @@ describe("buildCosmosDbFreeTierBicepSource", () => {
   });
 });
 
+describe("Functions host key infrastructure", () => {
+  it("reads the generated default host key without exposing a literal value", () => {
+    const expression = buildFunctionsHostKeyBicepExpression();
+    expect(expression).toContain("listKeys(");
+    expect(expression).toContain("functionKeys.default");
+  });
+
+  it("passes the key to SWA through a secure module parameter", () => {
+    const source = buildStaticWebAppConfigBicepSource();
+    expect(source).toContain("@secure()");
+    expect(source).toContain("param functionsHostKey string");
+    expect(source).toContain("BACKEND_FUNCTIONS_KEY: functionsHostKey");
+    expect(source).not.toContain("output functionsHostKey");
+  });
+});
+
 describe("GitHub Actions workflow generation", () => {
   it("uses npm ci for the SWA workflow when the project was initialized with pnpm", () => {
     const workflow = buildGitHubSwaWorkflow("npm", "pnpm");

package/src/__tests__/nextjs-generator.test.ts

@@ -21,6 +21,14 @@ describe("generateBFFCallFunction", () => {
     expect(code).toContain("export async function callFunction");
   });
 
+  it("uses a server-side Functions key and fails closed outside localhost", () => {
+    const code = generateBFFCallFunction();
+    expect(code).toContain("BACKEND_FUNCTIONS_KEY");
+    expect(code).toContain("'x-functions-key'");
+    expect(code).toContain("required for non-local Functions calls");
+    expect(code).not.toContain("?code=");
+  });
+
   it("includes z.ZodSchema typings", () => {
     const code = generateBFFCallFunction();
     expect(code).toContain("z.ZodSchema");

package/src/cli/commands/add-auth.ts

@@ -22,6 +22,23 @@ import {
   generateLoginPage,
   generateAuthContext,
   generateBFFCallFunctionWithAuth,
+  generateBFFCallFunctionWithSwaAuth,
+  generateSwaAuthHelperTS,
+  generateSwaAuthHelperCSharp,
+  generateSwaAuthHelperPython,
+  generateExternalTokenAdapter,
+  generateAuthenticatedFetch,
+  generateExternalTokenBFFMeRoute,
+  generateExternalTokenAuthContext,
+  generateExternalTokenVerifierTS,
+  generateExternalTokenHelperTS,
+  generateExternalAuthMeTS,
+  generateExternalTokenVerifierCSharp,
+  generateExternalTokenHelperCSharp,
+  generateExternalAuthMeCSharp,
+  generateExternalTokenVerifierPython,
+  generateExternalTokenHelperPython,
+  generateExternalAuthMePython,
 } from "../../core/scaffold/auth-generator";
 import { syncProjectManifest } from "../../core/project/manifest";
 import { buildSharedTsConfig } from "./init";
@@ -30,14 +47,194 @@ interface AddAuthOptions {
   provider?: string;
 }
 
+function writeIfMissing(filePath: string, content: string): void {
+  if (fs.existsSync(filePath)) return;
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, content, "utf-8");
+}
+
+function defaultCustomJwtConfig(): CustomJwtConfig {
+  return {
+    userConnector: "mysql",
+    userTable: "users",
+    loginIdColumn: "login_id",
+    passwordHashColumn: "password_hash",
+    rolesColumn: "roles",
+    jwtSecretEnv: "JWT_SECRET",
+    tokenExpiry: "24h",
+  };
+}
+
+function setupSwaAuth(cwd: string, backendLanguage: BackendLanguage): void {
+  const helperPath = backendLanguage === "typescript"
+    ? path.join(cwd, "functions", "src", "auth", "jwt-helper.ts")
+    : backendLanguage === "csharp"
+      ? path.join(cwd, "functions", "Auth", "JwtHelper.cs")
+      : path.join(cwd, "functions", "auth", "jwt_helper.py");
+  fs.mkdirSync(path.dirname(helperPath), { recursive: true });
+  const helper = backendLanguage === "typescript"
+    ? generateSwaAuthHelperTS()
+    : backendLanguage === "csharp"
+      ? generateSwaAuthHelperCSharp()
+      : generateSwaAuthHelperPython();
+  fs.writeFileSync(helperPath, helper, "utf-8");
+
+  const callFnPath = path.join(cwd, "lib", "api", "call-function.ts");
+  fs.mkdirSync(path.dirname(callFnPath), { recursive: true });
+  fs.writeFileSync(callFnPath, generateBFFCallFunctionWithSwaAuth(), "utf-8");
+
+  const authDir = path.join(cwd, "lib", "auth");
+  fs.mkdirSync(authDir, { recursive: true });
+  fs.writeFileSync(path.join(authDir, "auth-context.tsx"), generateSwaAuthContext(), "utf-8");
+  updateRootLayoutWithAuthProvider(cwd);
+  const loginDir = path.join(cwd, "app", "login");
+  fs.mkdirSync(loginDir, { recursive: true });
+  fs.writeFileSync(path.join(loginDir, "page.tsx"), generateSwaLoginPage(), "utf-8");
+  updateSwaRouteConfig(cwd);
+}
+
+function setupExternalTokenAuth(cwd: string, backendLanguage: BackendLanguage): void {
+  const authDir = path.join(cwd, "lib", "auth");
+  fs.mkdirSync(authDir, { recursive: true });
+  writeIfMissing(path.join(authDir, "external-token-adapter.ts"), generateExternalTokenAdapter());
+  fs.writeFileSync(path.join(authDir, "authenticated-fetch.ts"), generateAuthenticatedFetch(), "utf-8");
+  fs.writeFileSync(path.join(authDir, "auth-context.tsx"), generateExternalTokenAuthContext(), "utf-8");
+  fs.writeFileSync(path.join(cwd, "lib", "api", "call-function.ts"), generateBFFCallFunctionWithAuth(), "utf-8");
+  const meDir = path.join(cwd, "app", "api", "auth", "me");
+  fs.mkdirSync(meDir, { recursive: true });
+  fs.writeFileSync(path.join(meDir, "route.ts"), generateExternalTokenBFFMeRoute(), "utf-8");
+  updateRootLayoutWithAuthProvider(cwd);
+
+  if (backendLanguage === "typescript") {
+    const verifier = path.join(cwd, "functions", "src", "auth", "external-token-verifier.ts");
+    writeIfMissing(verifier, generateExternalTokenVerifierTS());
+    fs.writeFileSync(path.join(cwd, "functions", "src", "auth", "jwt-helper.ts"), generateExternalTokenHelperTS(), "utf-8");
+    fs.writeFileSync(path.join(cwd, "functions", "src", "auth-me.ts"), generateExternalAuthMeTS(), "utf-8");
+  } else if (backendLanguage === "csharp") {
+    const verifier = path.join(cwd, "functions", "Auth", "ExternalTokenVerifier.cs");
+    writeIfMissing(verifier, generateExternalTokenVerifierCSharp());
+    fs.writeFileSync(path.join(cwd, "functions", "Auth", "JwtHelper.cs"), generateExternalTokenHelperCSharp(), "utf-8");
+    fs.writeFileSync(path.join(cwd, "functions", "Auth", "ExternalAuthMe.cs"), generateExternalAuthMeCSharp(), "utf-8");
+  } else {
+    const verifier = path.join(cwd, "functions", "auth", "external_token_verifier.py");
+    writeIfMissing(verifier, generateExternalTokenVerifierPython());
+    fs.writeFileSync(path.join(cwd, "functions", "auth", "jwt_helper.py"), generateExternalTokenHelperPython(), "utf-8");
+    const authMePath = path.join(cwd, "functions", "blueprints", "auth_me.py");
+    fs.mkdirSync(path.dirname(authMePath), { recursive: true });
+    fs.writeFileSync(authMePath, generateExternalAuthMePython(), "utf-8");
+    updatePythonAuthMeRegistration(cwd);
+  }
+}
+
+function updatePythonAuthMeRegistration(cwd: string): void {
+  const appPath = path.join(cwd, "functions", "function_app.py");
+  if (!fs.existsSync(appPath)) return;
+  const importLine = "from blueprints.auth_me import bp as external_auth_me_bp";
+  const registerLine = "app.register_blueprint(external_auth_me_bp)";
+  let content = fs.readFileSync(appPath, "utf-8");
+  if (content.includes(importLine)) return;
+  const marker = "# SwallowKit scaffold registrations";
+  content = content.includes(marker)
+    ? content.replace(marker, `${importLine}\n${registerLine}\n${marker}`)
+    : `${content.trimEnd()}\n${importLine}\n${registerLine}\n`;
+  fs.writeFileSync(appPath, content, "utf-8");
+}
+
+function generateSwaLoginPage(): string {
+  return `'use client';
+export default function LoginPage() {
+  return <main><h1>Sign in</h1><a href="/.auth/login/aad?post_login_redirect_uri=/">Sign in with Microsoft</a></main>;
+}
+`;
+}
+
+export function generateSwaAuthContext(): string {
+  return `'use client';
+import { createContext, useContext, useEffect, useState, type ReactNode } from 'react';
+
+export interface AuthUser { id: string; loginId: string; name: string; email: string; roles: string[]; }
+interface AuthContextValue { user: AuthUser | null; loading: boolean; login: () => void; logout: () => void; hasRole: (role: string) => boolean; hasAnyRole: (roles: string[]) => boolean; }
+const AuthContext = createContext<AuthContextValue | null>(null);
+
+export function AuthProvider({ children }: { children: ReactNode }) {
+  const [user, setUser] = useState<AuthUser | null>(null);
+  const [loading, setLoading] = useState(true);
+  useEffect(() => {
+    fetch('/.auth/me')
+      .then(async response => {
+        if (!response.ok) throw new Error('SWA authentication is unavailable');
+        const body: unknown = await response.json();
+        if (!body || typeof body !== 'object' || !('clientPrincipal' in body)) return null;
+        const principal = body.clientPrincipal;
+        if (!principal || typeof principal !== 'object') return null;
+        const value = principal as Record<string, unknown>;
+        if (typeof value.userId !== 'string') return null;
+        return {
+          id: value.userId,
+          loginId: typeof value.userDetails === 'string' ? value.userDetails : '',
+          name: typeof value.userDetails === 'string' ? value.userDetails : '',
+          email: typeof value.userDetails === 'string' ? value.userDetails : '',
+          roles: Array.isArray(value.userRoles) ? value.userRoles.filter((role): role is string => typeof role === 'string') : [],
+        } satisfies AuthUser;
+      })
+      .then(setUser)
+      .catch(() => setUser(null))
+      .finally(() => setLoading(false));
+  }, []);
+  const login = () => { window.location.href = '/.auth/login/aad?post_login_redirect_uri=/'; };
+  const logout = () => { window.location.href = '/.auth/logout?post_logout_redirect_uri=/'; };
+  const hasRole = (role: string) => user?.roles.includes(role) ?? false;
+  return <AuthContext.Provider value={{ user, loading, login, logout, hasRole, hasAnyRole: roles => roles.some(hasRole) }}>{children}</AuthContext.Provider>;
+}
+export function useAuth() { const value = useContext(AuthContext); if (!value) throw new Error('useAuth must be used within an AuthProvider'); return value; }
+`;
+}
+
+export function addAuthProviderToRootLayout(layout: string): string {
+  let updated = layout;
+  if (!/import\s*\{[^}]*\bAuthProvider\b[^}]*\}\s*from\s*['"]@\/lib\/auth\/auth-context['"]/.test(updated)) {
+    const directive = updated.match(/^(?:\s*['"]use (?:client|server)['"];?\s*\r?\n)/)?.[0] ?? "";
+    updated = `${directive}import { AuthProvider } from '@/lib/auth/auth-context';\n${updated.slice(directive.length)}`;
+  }
+  if (!/<AuthProvider(?:\s|>)/.test(updated)) {
+    const childrenIndex = updated.lastIndexOf("{children}");
+    if (childrenIndex === -1) {
+      throw new Error("Could not find {children} in app/layout.tsx");
+    }
+    updated = `${updated.slice(0, childrenIndex)}<AuthProvider>{children}</AuthProvider>${updated.slice(childrenIndex + "{children}".length)}`;
+  }
+  return updated;
+}
+
+function updateRootLayoutWithAuthProvider(cwd: string): void {
+  const layoutPath = path.join(cwd, "app", "layout.tsx");
+  if (!fs.existsSync(layoutPath)) {
+    throw new Error("app/layout.tsx was not found; cannot install AuthProvider");
+  }
+  const layout = fs.readFileSync(layoutPath, "utf-8");
+  const updated = addAuthProviderToRootLayout(layout);
+  if (updated !== layout) fs.writeFileSync(layoutPath, updated, "utf-8");
+}
+
+function updateSwaRouteConfig(cwd: string): void {
+  const configPath = path.join(cwd, "staticwebapp.config.json");
+  const config = fs.existsSync(configPath) ? JSON.parse(fs.readFileSync(configPath, "utf-8")) : {};
+  config.routes = Array.isArray(config.routes)
+    ? config.routes.filter((route: { route?: string }) => route.route !== "/api/*")
+    : [];
+  config.routes.unshift({ route: "/api/*", allowedRoles: ["authenticated"] });
+  config.responseOverrides = { ...(config.responseOverrides || {}), "401": { statusCode: 302, redirect: "/.auth/login/aad?post_login_redirect_uri=.referrer" } };
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2), "utf-8");
+}
+
 export async function addAuthCommand(options: AddAuthOptions) {
   ensureSwallowKitProject("add-auth");
 
   console.log(" SwallowKit Add-Auth: Setting up authentication...\n");
 
   const provider = (options.provider || "custom-jwt") as AuthProvider;
-  if (!["custom-jwt", "swa", "swa-custom", "none"].includes(provider)) {
-    console.error(` Unknown provider: ${provider}. Use: custom-jwt | swa | swa-custom | none`);
+  if (!["custom-jwt", "swa", "external-token", "swa-custom", "none"].includes(provider)) {
+    console.error(` Unknown provider: ${provider}. Use: custom-jwt | swa | external-token | swa-custom | none`);
     process.exit(1);
   }
 
@@ -45,6 +242,31 @@ export async function addAuthCommand(options: AddAuthOptions) {
   const config = getFullConfig();
   const cwd = process.cwd();
 
+  if (provider === "swa-custom") {
+    throw new Error("The swa-custom provider is not implemented. Use --provider swa or --provider custom-jwt.");
+  }
+  if (provider === "none") {
+    updateConfigWithAuth(cwd, provider, config.auth?.customJwt || defaultCustomJwtConfig());
+    await syncProjectManifest();
+    console.log(" Authentication disabled in swallowkit.config.js");
+    return;
+  }
+  if (provider === "swa") {
+    setupSwaAuth(cwd, backendLanguage);
+    updateConfigWithAuth(cwd, provider, config.auth?.customJwt || defaultCustomJwtConfig());
+    await syncProjectManifest();
+    console.log("\n SWA built-in authentication setup complete!");
+    return;
+  }
+  if (provider === "external-token") {
+    setupExternalTokenAuth(cwd, backendLanguage);
+    updateConfigWithAuth(cwd, provider, config.auth?.customJwt || defaultCustomJwtConfig());
+    await syncProjectManifest();
+    console.log("\n External token authentication setup complete!");
+    console.log(" Implement the generated frontend adapter and backend verifier before use.");
+    return;
+  }
+
   // Read project name from package.json
   const pkgPath = path.join(cwd, "package.json");
   const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
@@ -59,15 +281,9 @@ export async function addAuthCommand(options: AddAuthOptions) {
   }
 
   // Default custom-jwt config
-  const customJwtConfig: CustomJwtConfig = config.auth?.customJwt || {
-    userConnector: "mysql",
-    userTable: "users",
-    loginIdColumn: "login_id",
-    passwordHashColumn: "password_hash",
-    rolesColumn: "roles",
-    jwtSecretEnv: "JWT_SECRET",
-    tokenExpiry: "24h",
-  };
+  const customJwtConfig: CustomJwtConfig = config.auth?.customJwt || defaultCustomJwtConfig();
+
+  // custom-jwt setup continues below.
 
   // 1. Generate shared/models/auth.ts
   console.log(" Generating auth models...");
@@ -359,10 +575,7 @@ function updateConfigWithAuth(cwd: string, provider: AuthProvider, config: Custo
   const beforeClosing = content.substring(0, closingBraceIdx).trimEnd();
   const needsComma = !beforeClosing.endsWith(",") && !beforeClosing.endsWith("{");
 
-  const authBlock = `${needsComma ? "," : ""}
-  // 認証認可設定
-  auth: {
-    provider: '${provider}',
+  const providerSettings = provider === "custom-jwt" ? `
     customJwt: {
       userConnector: '${config.userConnector}',
       userTable: '${config.userTable}',
@@ -371,7 +584,17 @@ function updateConfigWithAuth(cwd: string, provider: AuthProvider, config: Custo
       rolesColumn: '${config.rolesColumn}',
       jwtSecretEnv: '${config.jwtSecretEnv || "JWT_SECRET"}',
       tokenExpiry: '${config.tokenExpiry || "24h"}',
-    },
+    },` : provider === "swa" ? `
+    swa: {
+      allowedProviders: ['aad'],
+      roleSource: 'swa-roles',
+    },` : "";
+
+  const authBlock = `${needsComma ? "," : ""}
+  // 認証認可設定
+  auth: {
+    provider: '${provider}',
+${providerSettings}
     authorization: {
       defaultPolicy: 'authenticated',
     },